---
title: "Create a custom control for an audit"
method: POST
path: "/audits/{auditId}/controls/custom-controls"
tags: ["Audits"]
---

# Create a custom control for an audit

`POST /audits/{auditId}/controls/custom-controls`

Create a custom control for an audit.

Rate limit: 10 requests / minute.

## Path parameters

- `auditId` string, required

## Request body

- CreateCustomControlInput
  - `externalId` string, required — The external id of the control.
  - `name` string, nullable, required — The name of the control.
  - `description` string, required — The description of the control.
  - `effectiveDate` string, date-time, required — The effective date of the control.
  - `category` 'ARTIFICIAL_&_AUTONOMOUS_TECHNOLOGY' | 'ASSET_MANAGEMENT' | 'BUSINESS_CONTINUITY_&_DISASTER_RECOVERY' | 'CAPACITY_&_PERFORMANCE_PLANNING' | 'CHANGE_MANAGEMENT' | 'CLOUD_SECURITY' | 'COMPLIANCE' | 'CONFIGURATION_MANAGEMENT' | 'CONTINUOUS_MONITORING' | 'CRYPTOGRAPHIC_PROTECTIONS' | 'DATA_CLASSIFICATION_&_HANDLING' | 'EMBEDDED_TECHNOLOGY' | 'ENDPOINT_SECURITY' | 'HUMAN_RESOURCES_SECURITY' | 'IDENTIFICATION_&_AUTHENTICATION' | 'INCIDENT_RESPONSE' | 'INFORMATION_ASSURANCE' | 'MAINTENANCE' | 'MOBILE_DEVICE_MANAGEMENT' | 'NETWORK SECURITY' | 'PHYSICAL_&_ENVIRONMENTAL_SECURITY' | 'PRIVACY' | 'PROJECT_&_RESOURCE MANAGEMENT' | 'RISK_MANAGEMENT' | 'SECURE_ENGINEERING_&_ARCHITECTURE' | 'SECURITY_AWARENESS_&_TRAINING' | 'SECURITY_OPERATIONS' | 'SECURITY_&_PRIVACY_GOVERNANCE' | 'TECHNOLOGY_DEVELOPMENT_&_ACQUISITION' | 'THIRD-PARTY_MANAGEMENT' | 'THREAT_MANAGEMENT' | 'VULNERABILITY_&_PATCH_MANAGEMENT' | 'WEB_SECURITY' | 'ADMINISTRATIVE' | 'PHYSICAL' | 'TECHNICAL' | 'BASIC' | 'DERIVED', required
  - `sections` FrameworkSection[], nullable — Framework sections that the control should be mapped to.
    - `frameworkId` union, required
      - 'AU_E_8' | 'AWS_FTR' | 'CCPA' | 'CIS_V8' | 'CPS_234' | 'DORA' | 'FEDRAMP' | 'GDPR' | 'HIPAA' | 'HITRUST_E1' | 'ISO_27001' | 'ISO_27001_2022' | 'ISO_27017' | 'ISO_27018' | 'ISO_27701' | 'ISO_42001' | 'ISO_9001' | 'MSFT_SSPA' | 'MVSP' | 'NIS_2D' | 'NIST_171' | 'NIST_171_R3' | 'NIST_53' | 'NIST_AI_RMF' | 'NIST_CSF' | 'NIST_CSF_2' | 'OFDSS' | 'PCI_SAQ_A' | 'PCI_SAQ_A_EP' | 'PCI_SAQ_D_MERCHANT' | 'PCI_SAQ_D_SP' | 'PCI_DDS_4' | 'SOC_2' | 'SOX_ITGC' | 'UK_CYBER_ESSENTIALS' | 'US_DATA_PRIVACY'
      - string
    - `sectionId` string, required
  - `role` 'BOTH' | 'CONTROLLER' | 'PROCESSOR'

## Response `201`

Custom control created

- Control
  - `id` string, required — The control's unique ID.
  - `externalId` string, nullable, required — The control's external ID.
  - `name` string, required — The control's name.
  - `description` string, required — The control's description.
  - `source` 'Vanta' | 'Custom', required
  - `domains` string[], required — The security domains that the control belongs to.
  - `owner` Owner, required
    - `id` string, required — Unique identifier for the person.
    - `displayName` string, required — Name of the person that is shown in product.
    - `emailAddress` string, required — Email address of the person.
  - `role` string, nullable — The control's GDPR role, if the control is a GDPR control.
  - `customFields` CustomField[], required — The control's custom field values, if control custom fields is included in your Vanta instance.
    - `label` string, required
    - `value` union, required
      - string
      - string[]
  - `creationDate` string, date-time, nullable, required — When the control was created. Returns null for Vanta library controls.
  - `modificationDate` string, date-time, nullable, required — When the control was last modified. Returns null for Vanta library controls.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/versions/6c1f7590538b/schema)